Microsoft's AntiSpyware hit by a Spyware

Earthtimes.org ^ | 2005-02-10 | Martin Booth

[N3WBI3]

A Trojan has hit Microsoft's AntiSpyware (Beta), which disables it, and steals banking details login Ids and passwords.

Trojans or "Trojan horse" is a type of program that allows other people to access your machine (generally for malicious purposes) over the Internet.

Trojans cannot propagate themselves like a virus. You have to download an application or the server exe file, which is usually sent in an e-mail message.

The email message will promise you something good and would prompt you to download and installs the exe attachment. This is why it is called a Trojan horse -- you have to consciously or unconsciously run the EXE to install the server side on your computer. Once this is done then criminals who had designed the Trojan can remotely manipulate your computer.

The password stealing Troj/BankAsh-A Trojan, discovered yesterday, is a spyware. It keeps a track of user activities on the computer. It spies on you.

If you happen to visit any of the online bank accounts of Barclays, Cahoot, Halifax, HSBC, Lloyds TSB, Nationwide, NatWest, and Smile, then it starts recording your keystrokes. This way it steals your login ids and passwords. The Trojan then sends the details on a remote FTP. Trojan makers can then use those details to steal your money from your bank accounts.

The Trojan also disables Microsoft AntiSpyware, currently available only as a beta download. It deletes all files within the folder named C:Program FilesMicrosoft AntiSpyware. The Trojan also removes important entries of the antispyware in the registry and thus literal kills the antispyware.

Microsoft Antispyware is still in its Beta version (experimental version). Over a period of time software developers will know the flaws in the antispyware and would hopefully rectify them.

[N3WBI3]

ping..

[Mad Mammoth]

Late breaking news: Microsoft has announced that the beta version of it's anti-spyware program will be named in honor of Robert P. Hanssen.

[savedbygrace]

The MS spyware app was a mature product made by Giant Company, which MS bought. It's only called Beta because MS hasn't finished certifying, or whatever they do. But it worked great for many users before MS bought Giant.

If you don't open the .exe, you won't get burnt.

[Bones75]

Nice job, Gates. Your spyware remover program infects users with sypware. Somewhere there is a 16 year old programmer geek laughing his a** off.

This is typical Microsoft.

Bones

[sigSEGV]

Someday Microsoft will learn about the idea of privilege separation. There should be no way that a user process can shut off a system service. If they enforced non-admin users out of the box, this wouldn't happen.

[Wiz]

Oops!

[N3WBI3]

People have pointed out that the only system to do that is a Mac, aven linux does not *force* you to create a user. The one nice things most distros do is popup a warning whenever you start up X (dont know if thats a defaul in X, or distro specific) about how unsecure it is to run X as the root user. That and the fact the screen wont look for root is pretty nice..

[rit]

A Trojan has hit Microsoft's AntiSpyware (Beta), which disables it, and steals banking details login Ids and passwords.... You have to download an application or the server exe file, which is usually sent in an e-mail message.

It is more appropriate to say "downloading and installing this executable will disable Microsoft's AntiSpyware". Put the blame were it belongs: on the person distributing the trojan who tries to trick novice users into opening and running it. This is not Microsoft's fault.

[freebilly]

This isn't a problem with the anti-spyware. If people are crazy enough to open an email attachment from an unsafe source they deserve the resulting calamity.

Prior to MS buying Giant, Giant Anti-Spyware was touted as the best thing since sliced bread. Would its security vulnerabilities have been exploited Giant had continued on its own?

[sierrahome]

"If they enforced non-admin users out of the box, this wouldn't happen."

Amen

[alice_in_bubbaland]

I'm very leery of downloading any Microsoft fixes. Downloaded SP2 a few months ago, messed up my PC, had to remove it. I run adaware, spybot s&d, AVG antivirus & firewall, plus a pop-up blocker. I'm considering running Mozilla.

[rwfromkansas]

Exactly.

It is much better than even my Ad-Aware.

This article is rather senationalistic.

Unless you are an idiot and download the trojan from your e-mail, you will be fine.

[Littlejon]

Actually, the title is very misleading, as the anti-spyware does NOTHING to disable anything on your system and it DOES NOT install anything on your system without your knowledge. This is a trojan horse that MUST BE DOWLOADED and executed by the USER. Aside from recording your keystrokes, it also disables the anti-spyware software.

Microsoft is unfairly painted as idiots in this article. Now, whether or not they really ARE idiots is another debate, but, in this instance, the author has it in for Microsoft and is blaming their new anti-spyware software for something it does not do.

BTW - Check out where the article appears. That rag isn't exactly a big proponent of capitalism, now is it?

[Bones75]

You're right, I didn't notice that before.."Earthtimes.org"

bwahahahaa

Bones

[rwfromkansas]

Hey you all, check out the source:

Earthtimes.org......a liberal environmentalist group.

AKA....Apple lovers.

[Don Simmons]

Well, since all SpyWare is developed by the same pack of booger-eating morons....is this really much of a surprise to anyone?!?!?!?!

[kidd]

Same here.

I update and run Adaware and Spybot daily. The MS anti-spyware program found 7 spyware files that Adaware and Spybot missed.

[bitt]

http://www.informationweek.com/story/showArticle.jhtml?articleID=60300219

http://www.betanews.com/article/Trojan_Targets_Microsoft_AntiSpyware/1108078219

http://news.zdnet.co.uk/internet/security/0,39020375,39187428,00.htm

http://www.eweek.com/article2/0,1759,1763560,00.asp

[bitt]

also, for mozilla lovers:
http://www.eweek.com/article2/0,1759,1761502,00.asp